ci: checkout matrix consumers and enforce full pin validation

Clone all matrix consumer repos in Validate CI and fail strict checks
when dependency files are missing, so org-wide pin drift is caught.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Pigbibi

.github/workflows/validate.yml

@@ -34,8 +34,12 @@ jobs:
         run: python3 scripts/runtime_settings.py validate
       - name: Run unit tests
         run: python3 -m unittest discover -s tests -v
+      - name: Checkout internal dependency consumer repos
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bash scripts/checkout_internal_dependency_consumers.sh --output-root ..
       - name: Report internal dependency matrix
-        run: python3 scripts/check_internal_dependency_matrix.py --projects-root .. --json --strict
+        run: python3 scripts/check_internal_dependency_matrix.py --projects-root .. --json --strict --require-consumer-files
       - name: Validate strategy switch web assets
         run: |
           set -euo pipefail

scripts/check_internal_dependency_matrix.py

@@ -129,20 +129,30 @@ def build_parser() -> argparse.ArgumentParser:
     parser.add_argument("--projects-root", type=Path, default=DEFAULT_PROJECTS_ROOT)
     parser.add_argument("--json", action="store_true", help="Print machine-readable report.")
     parser.add_argument("--strict", action="store_true", help="Exit non-zero when drift is detected.")
+    parser.add_argument(
+        "--require-consumer-files",
+        action="store_true",
+        help="Treat missing consumer dependency files as validation failures.",
+    )
     return parser
 
 
 def main(argv: list[str] | None = None) -> int:
     args = build_parser().parse_args(argv)
     report = check_matrix(matrix_pins=load_matrix(args.matrix), projects_root=args.projects_root)
+    issues = list(report.issues)
+    if args.require_consumer_files and report.missing_files:
+        for item in report.missing_files:
+            issues.append(f"missing consumer dependency file {item}")
+    ok = not issues
     if args.json:
         print(
             json.dumps(
                 {
                     "checked_files": report.checked_files,
                     "missing_files": report.missing_files,
-                    "issues": report.issues,
-                    "ok": report.ok,
+                    "issues": issues,
+                    "ok": ok,
                 },
                 ensure_ascii=False,
                 indent=2,
@@ -154,13 +164,13 @@ def main(argv: list[str] | None = None) -> int:
             print("missing_files:")
             for item in report.missing_files:
                 print(f"- {item}")
-        if report.issues:
+        if issues:
             print("issues:")
-            for issue in report.issues:
+            for issue in issues:
                 print(f"- {issue}")
-        if report.ok:
+        if ok:
             print("internal dependency matrix is current")
-    return 1 if args.strict and not report.ok else 0
+    return 1 if args.strict and not ok else 0
 
 
 if __name__ == "__main__":

scripts/checkout_internal_dependency_consumers.sh

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+output_root=".."
+matrix_path="internal_dependency_matrix.json"
+
+usage() {
+  cat <<'EOF'
+Usage: checkout_internal_dependency_consumers.sh [--output-root PATH] [--matrix PATH]
+
+Clone QuantStrategyLab consumer repositories referenced by the internal dependency matrix.
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --output-root)
+      output_root="${2:?--output-root requires a path}"
+      shift 2
+      ;;
+    --matrix)
+      matrix_path="${2:?--matrix requires a path}"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+if ! command -v gh >/dev/null 2>&1; then
+  echo "gh CLI is required to checkout internal dependency consumer repos." >&2
+  exit 1
+fi
+
+if [ -z "${GH_TOKEN:-}" ] && [ -z "${GITHUB_TOKEN:-}" ]; then
+  echo "GH_TOKEN or GITHUB_TOKEN is required to checkout internal dependency consumer repos." >&2
+  exit 1
+fi
+
+export GH_TOKEN="${GH_TOKEN:-${GITHUB_TOKEN}}"
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "${script_dir}/.." && pwd)"
+matrix_file="${matrix_path}"
+if [ ! -f "${matrix_file}" ]; then
+  matrix_file="${repo_root}/${matrix_path}"
+fi
+if [ ! -f "${matrix_file}" ]; then
+  echo "Matrix file not found: ${matrix_path}" >&2
+  exit 1
+fi
+
+mkdir -p "${output_root}"
+output_root="$(cd "${output_root}" && pwd)"
+
+mapfile -t consumer_repos < <(
+  python3 - "${matrix_file}" <<'PY'
+import json
+import sys
+from pathlib import Path
+
+payload = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
+repos = sorted(
+    {
+        item["consumer_repo"]
+        for item in payload.get("dependencies", [])
+        if isinstance(item, dict) and item.get("consumer_repo")
+    }
+)
+for repo in repos:
+    print(repo)
+PY
+)
+
+for consumer_repo in "${consumer_repos[@]}"; do
+  target_dir="${output_root}/${consumer_repo}"
+  if [ -d "${target_dir}/.git" ]; then
+    echo "Already checked out ${consumer_repo} at ${target_dir}"
+    continue
+  fi
+  echo "Cloning QuantStrategyLab/${consumer_repo} into ${target_dir}"
+  gh repo clone "QuantStrategyLab/${consumer_repo}" "${target_dir}" -- --depth 1 --branch main
+done
+
+echo "Checked out ${#consumer_repos[@]} internal dependency consumer repositories under ${output_root}."

tests/test_internal_dependency_matrix.py

@@ -86,6 +86,24 @@ def test_current_matrix_matches_local_workspace(self):
         self.assertEqual(report.missing_files, [])
         self.assertEqual(report.issues, [])
 
+    def test_require_consumer_files_treats_missing_paths_as_issues(self):
+        projects_root = self._make_projects_root({})
+        expected = [
+            check_internal_dependency_matrix.DependencyPin(
+                consumer_repo="ExamplePlatform",
+                path="requirements.txt",
+                package="quant-platform-kit",
+                source_repo="QuantPlatformKit",
+                ref="v0.7.35",
+            )
+        ]
+
+        report = check_internal_dependency_matrix.check_matrix(matrix_pins=expected, projects_root=projects_root)
+
+        self.assertEqual(report.checked_files, 0)
+        self.assertEqual(report.missing_files, ["ExamplePlatform/requirements.txt"])
+        self.assertEqual(report.issues, [])
+
     def _make_projects_root(self, files: dict[str, str]) -> Path:
         import tempfile